TWTQ: Session activity reports
Hey everyone,
Here's This Week's Top Question (TWTQ):
Q: What are session activity reports? How do I view them?
A: Log360 helps you audit network activity with hundreds of reports based on the type of events found in your network logs. It also goes one step further by providing you with
session activity reports. These reports help you track entire user sessions from start to close, including details of their activity during the session. You can access them by going to the Correlation tab, and selecting the required report under
Activity Monitoring Reports on the left menu. Currently, the reports provided cover the following types of sessions:
- Windows interactive sessions
- Windows remote interactive sessions
- Windows Password Manager Pro sessions
- Unix sessions
Working with session activity reports
The default view of a session activity report provides you with the following information:
- The graph shows you the number of sessions started at various intervals during the selected time window.
- The table lists each session and specifies details such as the user and device names, start and end times, duration, and status of the session (active or ended).
- For sessions which are ended, the reason they were ended is also given — for instance, whether the session was properly closed or the device was shut down. For ongoing sessions, the duration column keeps updating to show you how long the user has been active.
- To track a user's activity during a session, you can click View History on the respective session's entry in the table. The popup which opens presents a timeline which lists out the user's various actions in chronological order.
You can also switch the report to a user-based or device-based view. You can do this by selecting the
User-based View or
Device-based View links which appear when you hover your mouse over the graph.
- User-based view: Tells you the number of sessions started by each user during the selected time window, and the devices they were active on.
- Device-based view: Tells you the number of sessions started on each device during the selected time window, and the users active on those devices.
To view sessions from a particular user or device, you can either:
- Use the search bar in any of the reports, or
- Navigate to the user or device-based view and click on the respective user/device name.
In this way, you can obtain granular information regarding user activity and remain up-to-date with all activities on your network.